From: Bjorn Helgaas <helgaas@kernel.org>
To: Ziming Du <duziming2@huawei.com>
Cc: bhelgaas@google.com, jbarnes@virtuousgeek.org, chrisw@redhat.com,
alex.williamson@redhat.com, linux-pci@vger.kernel.org,
linux-kernel@vger.kernel.org, liuyongqiang13@huawei.com
Subject: Re: [PATCH v2 1/3] PCI/sysfs: Fix null pointer dereference during hotplug
Date: Mon, 29 Dec 2025 11:31:06 -0600 [thread overview]
Message-ID: <20251229173106.GA69373@bhelgaas> (raw)
In-Reply-To: <20251224092721.2034529-2-duziming2@huawei.com>
On Wed, Dec 24, 2025 at 05:27:17PM +0800, Ziming Du wrote:
> During the concurrent process of creating and rescanning in VF, the
> resource files for the same pci_dev may be created twice. The second
> creation attempt fails, resulting the res_attr in pci_dev to kfree(),
> but the pointer is not set to NULL. This will subsequently lead to
> dereferencing a null pointer when removing the device.
>
> When we perform the following operation:
> echo $vfcount > /sys/class/net/"$pfname"/device/sriov_numvfs &
Is the value of $vfcount relevant here? Can you use the actual values
here instead of the variables so this is more useful to others?
> sleep 0.5
> echo 1 > /sys/bus/pci/rescan
> pci_remove "$pfname"
> system will crash as follows:
next prev parent reply other threads:[~2025-12-29 17:31 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-24 9:27 [PATCH v2 0/3] Miscellaneous fixes for pci subsystem Ziming Du
2025-12-24 9:27 ` [PATCH v2 1/3] PCI/sysfs: Fix null pointer dereference during hotplug Ziming Du
2025-12-29 17:31 ` Bjorn Helgaas [this message]
2025-12-30 3:40 ` duziming
2025-12-24 9:27 ` [PATCH v2 2/3] PCI: Prevent overflow in proc_bus_pci_write() Ziming Du
2025-12-29 18:07 ` Bjorn Helgaas
2025-12-30 8:20 ` duziming
2025-12-31 9:31 ` Ilpo Järvinen
2025-12-31 17:04 ` Bjorn Helgaas
2026-01-04 7:17 ` duziming
2025-12-24 9:27 ` [PATCH v2 3/3] PCI/sysfs: Prohibit unaligned access to I/O port on non-x86 Ziming Du
2025-12-29 9:36 ` Ilpo Järvinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251229173106.GA69373@bhelgaas \
--to=helgaas@kernel.org \
--cc=alex.williamson@redhat.com \
--cc=bhelgaas@google.com \
--cc=chrisw@redhat.com \
--cc=duziming2@huawei.com \
--cc=jbarnes@virtuousgeek.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=liuyongqiang13@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox